diff --git a/internal/variables/variables.go b/internal/variables/variables.go index 717b18f8b..14ecd7c6b 100644 --- a/internal/variables/variables.go +++ b/internal/variables/variables.go @@ -4,7 +4,7 @@ //go:generate go run generator/main.go // Package variables contains the representation of the variables used in the rules -// Variables are created as bytes and they have a string representation +// Variables are created as bytes, and they have a string representation package variables // This internal file contains all variables supported by handling of SecLang, such as @@ -236,4 +236,22 @@ const ( ResBodyProcessorError // ResBodyProcessorErrorMsg ResBodyProcessorErrorMsg + // Time + Time + // TimeDay + TimeDay + // TimeEpoch + TimeEpoch + // TimeHour + TimeHour + // TimeMin + TimeMin + // TimeMon + TimeMon + // TimeSec + TimeSec + // TimeWday + TimeWday + // TimeYear + TimeYear ) diff --git a/internal/variables/variables_test.go b/internal/variables/variables_test.go index cd42bf8c3..a73413721 100644 --- a/internal/variables/variables_test.go +++ b/internal/variables/variables_test.go @@ -18,7 +18,7 @@ import ( ) func TestNameToVariable(t *testing.T) { - vars := []string{"URLENCODED_ERROR", "RESPONSE_CONTENT_TYPE", "UNIQUE_ID", "ARGS_COMBINED_SIZE", "AUTH_TYPE", "FILES_COMBINED_SIZE", "FULL_REQUEST", "FULL_REQUEST_LENGTH", "INBOUND_DATA_ERROR", "MATCHED_VAR", "MATCHED_VAR_NAME", "MULTIPART_BOUNDARY_QUOTED", "MULTIPART_BOUNDARY_WHITESPACE", "MULTIPART_CRLF_LF_LINES", "MULTIPART_DATA_AFTER", "MULTIPART_DATA_BEFORE", "MULTIPART_FILE_LIMIT_EXCEEDED", "MULTIPART_HEADER_FOLDING", "MULTIPART_INVALID_HEADER_FOLDING", "MULTIPART_INVALID_PART", "MULTIPART_INVALID_QUOTING", "MULTIPART_LF_LINE", "MULTIPART_MISSING_SEMICOLON", "MULTIPART_STRICT_ERROR", "MULTIPART_UNMATCHED_BOUNDARY", "OUTBOUND_DATA_ERROR", "PATH_INFO", "QUERY_STRING", "REMOTE_ADDR", "REMOTE_HOST", "REMOTE_PORT", "REQBODY_ERROR", "REQBODY_ERROR_MSG", "REQBODY_PROCESSOR_ERROR", "REQBODY_PROCESSOR_ERROR_MSG", "REQBODY_PROCESSOR", "REQUEST_BASENAME", "REQUEST_BODY", "REQUEST_BODY_LENGTH", "REQUEST_FILENAME", "REQUEST_LINE", "REQUEST_METHOD", "REQUEST_PROTOCOL", "REQUEST_URI", "REQUEST_URI_RAW", "RESPONSE_BODY", "RESPONSE_CONTENT_LENGTH", "RESPONSE_PROTOCOL", "RESPONSE_STATUS", "SERVER_ADDR", "SERVER_NAME", "SERVER_PORT", "SESSIONID", "RESPONSE_HEADERS_NAMES", "REQUEST_HEADERS_NAMES", "USERID", "ARGS", "ARGS_GET", "ARGS_POST", "FILES_SIZES", "FILES_NAMES", "FILES_TMP_CONTENT", "MULTIPART_FILENAME", "MULTIPART_NAME", "MATCHED_VARS_NAMES", "MATCHED_VARS", "FILES", "REQUEST_COOKIES", "REQUEST_HEADERS", "RESPONSE_HEADERS", "GEO", "REQUEST_COOKIES_NAMES", "FILES_TMPNAMES", "ARGS_NAMES", "ARGS_GET_NAMES", "ARGS_POST_NAMES", "RULE", "XML", "TX", "DURATION"} + vars := []string{"URLENCODED_ERROR", "RESPONSE_CONTENT_TYPE", "UNIQUE_ID", "ARGS_COMBINED_SIZE", "AUTH_TYPE", "FILES_COMBINED_SIZE", "FULL_REQUEST", "FULL_REQUEST_LENGTH", "INBOUND_DATA_ERROR", "MATCHED_VAR", "MATCHED_VAR_NAME", "MULTIPART_BOUNDARY_QUOTED", "MULTIPART_BOUNDARY_WHITESPACE", "MULTIPART_CRLF_LF_LINES", "MULTIPART_DATA_AFTER", "MULTIPART_DATA_BEFORE", "MULTIPART_FILE_LIMIT_EXCEEDED", "MULTIPART_HEADER_FOLDING", "MULTIPART_INVALID_HEADER_FOLDING", "MULTIPART_INVALID_PART", "MULTIPART_INVALID_QUOTING", "MULTIPART_LF_LINE", "MULTIPART_MISSING_SEMICOLON", "MULTIPART_STRICT_ERROR", "MULTIPART_UNMATCHED_BOUNDARY", "OUTBOUND_DATA_ERROR", "PATH_INFO", "QUERY_STRING", "REMOTE_ADDR", "REMOTE_HOST", "REMOTE_PORT", "REQBODY_ERROR", "REQBODY_ERROR_MSG", "REQBODY_PROCESSOR_ERROR", "REQBODY_PROCESSOR_ERROR_MSG", "REQBODY_PROCESSOR", "REQUEST_BASENAME", "REQUEST_BODY", "REQUEST_BODY_LENGTH", "REQUEST_FILENAME", "REQUEST_LINE", "REQUEST_METHOD", "REQUEST_PROTOCOL", "REQUEST_URI", "REQUEST_URI_RAW", "RESPONSE_BODY", "RESPONSE_CONTENT_LENGTH", "RESPONSE_PROTOCOL", "RESPONSE_STATUS", "SERVER_ADDR", "SERVER_NAME", "SERVER_PORT", "SESSIONID", "RESPONSE_HEADERS_NAMES", "REQUEST_HEADERS_NAMES", "USERID", "ARGS", "ARGS_GET", "ARGS_POST", "FILES_SIZES", "FILES_NAMES", "FILES_TMP_CONTENT", "MULTIPART_FILENAME", "MULTIPART_NAME", "MATCHED_VARS_NAMES", "MATCHED_VARS", "FILES", "REQUEST_COOKIES", "REQUEST_HEADERS", "RESPONSE_HEADERS", "GEO", "REQUEST_COOKIES_NAMES", "FILES_TMPNAMES", "ARGS_NAMES", "ARGS_GET_NAMES", "ARGS_POST_NAMES", "RULE", "XML", "TX", "DURATION", "TIME", "TIME_DAY", "TIME_EPOCH", "TIME_HOUR", "TIME_MIN", "TIME_MON", "TIME_SEC", "TIME_WDAY", "TIME_YEAR"} for _, v := range vars { _, err := Parse(v) if err != nil { diff --git a/internal/variables/variablesmap.gen.go b/internal/variables/variablesmap.gen.go index 8b707aced..0bbb4b949 100644 --- a/internal/variables/variablesmap.gen.go +++ b/internal/variables/variablesmap.gen.go @@ -206,6 +206,24 @@ func (v RuleVariable) Name() string { return "RES_BODY_PROCESSOR_ERROR" case ResBodyProcessorErrorMsg: return "RES_BODY_PROCESSOR_ERROR_MSG" + case Time: + return "TIME" + case TimeDay: + return "TIME_DAY" + case TimeEpoch: + return "TIME_EPOCH" + case TimeHour: + return "TIME_HOUR" + case TimeMin: + return "TIME_MIN" + case TimeMon: + return "TIME_MON" + case TimeSec: + return "TIME_SEC" + case TimeWday: + return "TIME_WDAY" + case TimeYear: + return "TIME_YEAR" default: return "INVALID_VARIABLE" @@ -309,6 +327,15 @@ var rulemapRev = map[string]RuleVariable{ "RES_BODY_ERROR_MSG": ResBodyErrorMsg, "RES_BODY_PROCESSOR_ERROR": ResBodyProcessorError, "RES_BODY_PROCESSOR_ERROR_MSG": ResBodyProcessorErrorMsg, + "TIME": Time, + "TIME_DAY": TimeDay, + "TIME_EPOCH": TimeEpoch, + "TIME_HOUR": TimeHour, + "TIME_MIN": TimeMin, + "TIME_MON": TimeMon, + "TIME_SEC": TimeSec, + "TIME_WDAY": TimeWday, + "TIME_YEAR": TimeYear, } var errUnknownVariable = errors.New("unknown variable") diff --git a/types/variables/variables.go b/types/variables/variables.go index 659703072..1953ccbd6 100644 --- a/types/variables/variables.go +++ b/types/variables/variables.go @@ -196,6 +196,24 @@ const ( ResBodyProcessorErrorMsg = variables.ResBodyProcessorErrorMsg // MultipartStrictError will be set to 1 when there is an error parsing multipart MultipartStrictError = variables.MultipartStrictError + // Time holds a formatted string representing the time (hour:minute:second). + Time = variables.Time + // TimeDay holds the current day of the month (1-31) + TimeDay = variables.TimeDay + // TimeEpoch holds the time in seconds since 1970 + TimeEpoch = variables.TimeEpoch + // TimeHour holds the current hour of the day (0-23) + TimeHour = variables.TimeHour + // TimeMin holds the current minute of the hour (0-59) + TimeMin = variables.TimeMin + // TimeMon holds the current month of the year (0-11) + TimeMon = variables.TimeMon + // TimeSec holds the current second of the minute (0-59) + TimeSec = variables.TimeSec + // TimeWday holds the current weekday value (1–7), where Monday is 1 + TimeWday = variables.TimeWday + // TimeYear the current four-digit year value + TimeYear = variables.TimeYear ) // Parse returns the byte interpretation